Why Isn't AutoSSL Issuing a Certificate? 6 Common Causes

On our plans, SSL certificates are issued and renewed automatically by cPanel's AutoSSL through Let's Encrypt. Most of the time you don't need to do anything. If a certificate wasn't issued, the cause is almost always one of the items below.

How AutoSSL validates a domain

Before a certificate is issued, it must be proven that the domain really points to this server. The certificate authority tries to read a temporary validation file under /.well-known/ on your site, or checks via DNS. If that fails, no certificate is issued.

To see the status, open Security › SSL/TLS Status in cPanel. Clicking the warning icon next to a domain shows the reason for the error.

1. The domain doesn't point to this server yet

This is the most common cause. If you changed nameservers recently, propagation may not be complete. Our DNS propagation article explains how long it can take. Once it has finished, press Run AutoSSL on the SSL/TLS Status screen.

2. Missing DNS records for www or subdomains

The certificate is requested for both example.com and www.example.com. If there is no A or CNAME record for www, only that name fails. The same applies to automatic names such as mail and cpanel; if you don't use them, these warnings don't affect your site.

3. Cloudflare proxy or redirect settings

If you use your domain through Cloudflare with the orange cloud (proxy), the validation request passes through Cloudflare. An "always use HTTPS" setting or a strict security rule there can block access to the validation file. Temporarily turning off the proxy (grey cloud), or using Cloudflare's own edge certificate with SSL mode set to "Full", can solve it.

4. .htaccess rules block the validation file

A rule that redirects every request elsewhere, or blocks hidden folders, can affect the /.well-known/ path too. Add an exception for that folder at the top of your redirect rules. Examples are in the .htaccess redirect guide.

5. An AAAA (IPv6) record points elsewhere

If an old AAAA record pointing to a previous server remains on your domain, validation may go to the wrong server over IPv6. Delete AAAA records that belong to the old server.

6. A CAA record doesn't allow Let's Encrypt

If your DNS has a CAA record, only the certificate authorities listed there may issue certificates. Make sure Let's Encrypt is listed, or remove the CAA record if you don't use it.

After the certificate is issued

If the browser still says "not secure" after the certificate arrives, the problem is usually files on the page still loading over HTTP. We explain the fix in our mixed content guide. If the certificate still isn't issued after all these steps, open a support ticket with the error text from the SSL/TLS Status screen.